Global Surge in ClickFix Social Engineering Campaigns

The ClickFix technique has emerged as a high-volume social engineering threat, targeting enterprise and consumer devices by impersonating reputable brands like Google, Microsoft, Cloudflare, and GitHub. Attackers leverage landing pages that mimic software crashes or verification prompts to trick users into manually copying and pasting malicious commands into the Windows Run dialog or macOS Terminal.

Technically, these campaigns deliver a wide range of payloads including Lumma Stealer, MacSync, and Atomic macOS Stealer (AMOS). Recent iterations show a significant shift toward macOS targeting, utilizing fileless execution chains and AppleScript-based loaders to bypass traditional Gatekeeper protections. The impact is severe, resulting in the theft of browser credentials, cryptocurrency wallets, and cloud service tokens (AWS/GCloud). Business operations face high urgency due to the ability of these tools to hijack authenticated sessions and persistent remote access capabilities.